Check SPDX SBOM for NTIA minimum elements
This tool determines whether a SPDX software bill of materials (SBOM) document contains the National Telecommunications and Information Administration (NTIA) "minimum elements." The mapping of the NTIA elements required data fields to the SPDX specification can be found here.
The minimum elements include:
As defined by the NTIA, the minimum elements are "the essential pieces that support basic SBOM functionality and will serve as the foundation for an evolving approach to software transparency."
To install use the following command:
pip install ntia-conformance-checker
Alternatively, just clone the repo and install dependencies using the following commands:
git clone https://github.com/spdx/ntia-conformance-checker.git
pip install .
The tool requires Python 3 (3.8+). It is recommended to use a virtual python environment especially
if you are using different versions of python. virtualenv
is a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.
Usage: ntia-checker [OPTIONS]
Options:
--file TEXT The file to be parsed
--output [print|json] Output format [default: print]
-v, --verbose Use verbose printing
--output_path TEXT Filepath for optionally storing output.
-h, --help Show this message and exit.
The user can then analyze a particular file:
ntia-checker --file sbom.json
To generare the output in machine-readable JSON, run:
ntia-checker --file sbom.spdx --output json
ntia-conformance-checker
can also be imported as a library. For example:
import ntia_conformance_checker as ntia
sbom = ntia.SbomChecker("SBOM_filepath")
print(sbom.ntia_mininum_elements_compliant)
Additional properties and methods associated with SbomChecker()
can be found in sbom_checker.py
.
This is the result of an initial Google Summer of Code (GSoC) contribution in 2022 by @linynjosh and is maintained by a community of SPDX adopters and enthusiasts.
Contributions are very welcome! See CONTRIBUTING.md for instructions on how to contribute to the codebase.
Check out the frequently asked questions document.